yAxis

Program Overview

yAxis is a meta yield-aggregator designed to deploy capital to the best yield strategy available. Unlike other yield aggregators, yAxis will be able to switch underlying assets when deploying strategy. At its core, yAxis is a DAO-directed yield farming platform where YAX holders vote regularly on which yVault/aggregator strategy to implement with user funds.

yAxis is interested in securing its smart contracts, such as those covering strategy, staking, liquidity provision, and storage reference, as well as the YAX token contract itself and most importantly, the yAxisMetavault. yAxis is also interested in securing their website, but has no rewards for bug reports around that at the moment.

Verification

Verification of yAxis’ bug bounty program on Immunefi is available at https://yaxis.ghost.io/yaxis-security-bug-bounty-on-immunefi/

Rewards by Threat Level

Rewards are distributed according to the impact of the vulnerability based on the Immunefi Vulnerability Severity Classification System. This is a simplified 5-level scale, with separate scales for websites/apps and smart contracts/blockchains, encompassing everything from consequence of exploitation to privilege required to likelihood of a successful exploit. The listed rewards represent the maximum that will be paid out for a security bug reporting. Vulnerability reports on smart contracts must be accompanied by a Proof of Concept (POC) demonstrating the attack.

Level	Payout	Est. Current Value (USD)
Critical	5,000 YAX	up to $85,800
High	1,000 YAX	$17,160
Medium	500 YAX	$8,580
Low	100 YAX	$1,716

Payouts are handled by yAxis directly. The payouts are based on and completed in YAX. A USD estimate of the current value of the token is provided for reference. Estimates are updated regularly, though should not be relied on.

Assets in Scope & Eligible for Bounty

Target	Type
https://github.com/yaxis-project/metavault	Smart Contract - (Source Code)
https://etherscan.io/address/0xbfbec72f2450ef9ab742e4a27441fa06ca79ea6a#code	Smart Contract - yAxisMetavault

Assets in Scope & Ineligible for Bounty

The following assets are considered in-scope, but will not be rewarded with any bounty for reports.

Target	Type
https://etherscan.io/address/0xeF31Cb88048416E301Fee1eA13e7664b887BA7e8#code	Smart Contract - yAxisBar (Staking Contract)
https://etherscan.io/address/0xb1dc9124c395c1e97773ab855d66e879f053a289#code	Smart Contract - yAxis Token
https://etherscan.io/address/0xc330e7e73717cd13fb6ba068ee871584cf8a194f#code	Smart Contract - yAxisChef (Liquidity Provider)
https://yaxis.io	Website*

*Includes all paths and sub-domains, DNS, and email configuration.

Prioritized Smart Contract/Blockchain Vulnerabilities

We are especially interested in receiving and rewarding vulnerabilities of the following types:

• Re-entrancy
• Logic errors – Including user authentication errors
• Solidity/EVM details not considered
  • Including integer over-/under-flow
  • Including unhandled exceptions
• Trusting trust/dependency vulnerabilities
  • Including composability vulnerabilities
• Oracle failure/manipulation
• Novel governance attacks
• Economic/financial attacks
  • Including flash loan attacks
• Congestion and scalability
  • Including running out of gas
  • Including block stuffing
  • Including susceptibility to frontrunning
• Consensus failures
• Cryptography problems
  • Signature malleability
  • Susceptibility to replay attacks
  • Weak randomness
  • Weak encryption
• Susceptibility to block timestamp manipulation
• Missing access controls / unprotected internal or debugging interfaces

Accepted Website Vulnerabilities

We accept the following website vulnerabilities, though there is no reward for them:

• Remote Code Execution
• Trusting trust/dependency vulnerabilities
• Vertical Privilege Escalation
• XML External Entities Injection
• SQL Injection
• LFI/RFI
• Horizontal Privilege Escalation
• Stored XSS
• Reflective XSS with impact
• CSRF
• CSRF with impact
• Direct object reference
• Internal SSRF
• Session fixation
• Insecure Deserialization
• Direct object reference
• Path Traversal
• DOM XSS
• SSL misconfigurations
• SSL/TLS issues (weak crypto, improper setup)
• URL redirect
• Clickjacking
• Misleading Unicode text (e.g. using right to left override characters)
• Coercing the application to display/return specific text to other users

Out of Scope & Rules

The following vulnerabilities are excluded from the rewards for this bug bounty program:

• Attacks that the reporter has already exploited himself, leading to damage
• Attacks that rely on social engineering
• Attacks requiring access to leaked keys/credentials
• Attacks requiring access to privileged addresses (governance, strategist)
• Incorrect data supplied by third party oracles
• Basic economic governance attacks (e.g. 51% attack)
• Lack of liquidity
• Best practice critiques
• Deployment/private keys/secrets in test data
• Sybil attacks

The following vulnerabilities are not sought after for website bug reports:

• Theoretical vulnerabilities without any proof or demonstration
• Content spoofing / Text injection issues
• Self-XSS
• Captcha bypass using OCR
• CSRF with no security impact (logout CSRF, change language, etc.)
• Missing HTTP Security Headers (such as X-FRAME-OPTIONS) or cookie security flags (such as “httponly”)
• Server-side information disclosure such as IPs, server names, and most stack traces
• Vulnerabilities used to enumerate or confirm the existence of users or tenants
• Vulnerabilities requiring unlikely user actions
• URL Redirects (unless combined with another vulnerability to produce a more severe vulnerability)
• Lack of SSL/TLS best practices
• DDoS vulnerabilities
• Attacks requiring privileged access from within the organization

The following activities are prohibited by bug bounty program:

• Any testing with mainnet or public testnet contracts; all testing should be done on private testnets
• Any testing with pricing oracles or third party smart contracts
• Attempting phishing or other social engineering attacks against our employees and/or customers
• Any testing with third party systems and applications (e.g. browser extensions) as well as websites (e.g. SSO providers, advertising networks)
• Any denial of service attacks
• Automated testing of services that generates significant amounts of traffic
• Public disclosure of an unpatched vulnerability in an embargoed bounty